[SRU][N][PATCH v2 0/1] CVE-2025-40364

[Tim Whisonant]

SRU Justification:

[Impact]

io_uring: fix io_req_prep_async with provided buffers

io_req_prep_async() can import provided buffers, commit the ring state
by giving up on that before, it'll be reimported later if needed.

[Fix]

Plucky:   not affected
Oracular: not affected
Noble:    cherry picked from upstream stable linux-6.6.y
Jammy:    not affected
Focal:    not affected
Bionic:   not affected
Xenial:   not affected
Trusty:   not affected

[Test Plan]

Compile and boot tested.

[Where problems could occur]

The change affects the io_uring internals. Issues may appear
as transfer failures in asynchronous mode transactions.

[Notes]

Plucky and Oracular are listed as "not affected" because they
both contain commit e10677a8f6980dbae2e866b8320d90bae07e87ee
("io_uring: drop ->prep_async()"), which removes the function
targeted by the fix commit.

v2 - review of v1 revealed that the fix commit is located
on stable linux-6.6.y. v2 reflects this realization.

Pavel Begunkov (1):
  io_uring: fix io_req_prep_async with provided buffers

 io_uring/io_uring.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

-- 
2.43.0